> I mean, makes sense if your threat model includes people pushing malicious code to CI, but aren't you more or less done for at that point anyway? Maybe. Bac

> I mean, makes sense if your threat model includes people pushing malicious code to CI, but aren't you more or less done for at that point anyway? Maybe. Back in the old days if you had the commit bit your badge didn’t get you into the server room. I get the impression a lot of shops are effectively giving their devs root but in the cloud this time, which isn’t necessary.